Privacy Policy

1. Who We Are

Highbound, Inc. ("Highbound," "we," "our," or "us") operates the BibScore mobile application and the website at bibscore.com (collectively, the "Service"). BibScore is a community-powered platform that helps families find restaurants with family-friendly amenities in the Houston area.

This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Service. It also explains your rights regarding your data and how to exercise them.

By creating an account or using BibScore, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create a BibScore account, you sign in using either Google Sign-In or Apple Sign-In. Through this process, we receive and store:

• Google Sign-In: Your name, email address, and profile photo as provided by Google.
• Apple Sign-In: Your name and email address as provided by Apple. If you choose to use Apple's "Hide My Email" feature, we receive a unique private relay email address rather than your personal email. We do not have access to your Apple ID password.

We use this information solely to create your BibScore account, display your public profile, and communicate with you about the Service. We do not access your Google or Apple account beyond the information provided during sign-in.

2.2 User-Generated Content

When you contribute to BibScore, we collect and store the content you submit:

• Amenity reports: Your yes/no reports about restaurant amenities (e.g., high chairs, changing tables, play areas), including the time of submission and the establishment you are reporting on.
• Photos: If you upload photos with your amenity reports, those images are stored in Google Cloud Storage and associated with your report. Photos attached to reports are visible to all BibScore users when viewing the establishment.
• Edit suggestions: If you suggest corrections to restaurant information (name, address, phone number, hours, or closure status), we store those suggestions along with your user ID.
• Data issue reports: If you report a data issue (e.g., a restaurant is permanently closed or at the wrong location), we store that report with your user ID.
• Flags: If you flag another user's amenity report as inaccurate, we store that flag with your user ID.

Important: Amenity reports and your display name are visible to all BibScore users. Your email address is never displayed publicly.

2.3 Location Data

With your explicit permission (granted through your device's operating system), BibScore accesses your device's precise location to display restaurants near you on the map. We only request "when in use" location permission — we never track your location in the background, use geofencing outside the app, or infer movement patterns, home locations, or commute routes.

When you perform a search, we log the search coordinates (the center of the area you searched) and, if you have granted location permission, your device's current location at the time of the search. This data is stored in our search event logs and used to analyze which neighborhoods have the most demand for family-friendly dining information, helping us prioritize where to add more establishment data. Search event data is retained for up to 24 months and then permanently deleted.

You can revoke location access at any time through your device settings (iOS: Settings → Privacy & Security → Location Services → BibScore). The app will continue to work without location access, but you will need to manually search for areas instead of seeing nearby results. Revoking location access stops us from collecting your device location in future search events.

2.4 Device and Usage Information

We automatically collect certain technical information when you use the Service:

• Anonymous device identifier: On first launch, the app generates a random identifier (a UUID) to distinguish your device. This is not a hardware identifier (such as IDFA or IDFV) — it is a random value with no personally identifiable information. It is cleared when you uninstall the app.
• Session tracking: We generate a session identifier each time you open the app (or return after more than 5 minutes in the background) to group related activity within a single usage session.
• Search event data: Each time you search for establishments, we log the search parameters (coordinates, radius, text query, amenity filters, score filters, sort order), the number of results returned, and server response time. This data helps us understand search demand and improve coverage.
• Device information: Device type, operating system and version.
• Usage data: Features you use, screens you view, actions you take, the date and time of your interactions, and session duration.
• Crash data: If the app crashes, we may collect diagnostic information including crash logs and stack traces to help us fix bugs.
• IP address: Collected automatically with network requests. We do not use your IP address to track your activity or build a profile.

3. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your information for advertising, profiling, or automated decision-making that produces legal effects.

4. How We Share Your Information

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.

We share information only in the following limited circumstances:

4.1 Publicly Visible Content

Your display name, profile photo, and amenity reports are visible to all BibScore users. Your email address is never shared publicly.

4.2 Service Providers

We use the following third-party service providers to operate BibScore. These providers process your data on our behalf under data processing agreements and are contractually obligated to protect it in accordance with applicable law:

4.3 Legal Requirements

We may disclose your information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, or legal process; (b) enforce our Terms of Service; (c) protect the rights, safety, or property of Highbound, Inc., our users, or the public; or (d) respond to an emergency involving danger of death or serious physical injury.

4.4 Business Transfers

If Highbound, Inc. is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email or prominent notice within the app before your information becomes subject to a different privacy policy.

5. Data Retention

We retain your data for as long as necessary to provide the Service and fulfill the purposes described in this policy:

6. Account Deletion

You can delete your BibScore account at any time from within the app by going to Profile → Settings → Delete Account. You can also request account deletion by emailing privacy@bibscore.com.

When you delete your account:

• Your profile information (name, email, avatar) is permanently deleted.
• Your authentication credentials are removed from our systems.
• Your amenity reports are anonymized — they remain in the system to preserve community data, but are no longer associated with your identity.
• Your search history (all search event data associated with your account) is permanently deleted.
• Your photos, edit suggestions, flags, and data issue reports are permanently deleted.

Account deletion is processed within 30 days. Some data may persist in encrypted backups for up to 90 days after deletion, after which it is permanently purged.

7. Data Security

We take the security of your data seriously and implement appropriate technical and organizational measures, including:

• Encryption in transit: All data transmitted between your device, our servers, and third-party providers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Data stored in our database and cloud storage is encrypted at rest using industry-standard encryption.
• Authentication security: We use JSON Web Tokens (JWTs) with asymmetric cryptographic verification. We never store your Google or Apple password.
• Access controls: Access to production systems and user data is restricted to authorized personnel.
• Infrastructure security: Our backend runs on Google Cloud Platform, which maintains SOC 2, ISO 27001, and other security certifications.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of a security vulnerability, please contact us immediately at security@bibscore.com.

8. Children's Privacy

BibScore is designed for use by parents, caregivers, and adults who are looking for family-friendly dining options. The Service is not directed to children under 13 (or under 16 in certain jurisdictions), and we do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child under 13 has created a BibScore account or provided personal information to us, please contact us at privacy@bibscore.com. We will promptly delete the child's account and associated data.

9. Your Rights

9.1 All Users

Regardless of where you live, you can:

• Access your data: View your profile and reports within the app.
• Correct your data: Update your display name and profile through your account settings.
• Delete your data: Delete your account as described in Section 6.
• Delete your search history: Request deletion of your search event data by contacting us at privacy@bibscore.com. Search history is also automatically deleted when you delete your account.
• Withdraw consent: Revoke location access through your device settings at any time.

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: You can request details about the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: You can request that we delete your personal information, subject to certain legal exceptions.
• Right to correct: You can request that we correct inaccurate personal information.
• Right to opt-out of sale/sharing: We do not sell your personal information as defined under the CCPA/CPRA. We do not "share" your personal information (as defined under CPRA) with third parties for cross-context behavioral advertising.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to limit use of sensitive personal information: We collect precise geolocation (classified as sensitive personal information under CPRA) solely to provide the core map functionality of the Service. You can limit this by disabling location access on your device.

To exercise your rights, email privacy@bibscore.com with the subject line "CCPA Request." We will verify your identity and respond within 45 days.

Categories of personal information collected in the preceding 12 months: Identifiers (name, email, user ID, device identifier, IP address); geolocation data (precise device location, search coordinates); search activity data (search queries, filters, coordinates, timestamps); internet or electronic network activity (usage data, device information); user-generated content (reports, photos, edit suggestions).

9.3 Other Jurisdictions

If you reside in a jurisdiction with data protection laws (such as the EU/EEA under GDPR, the UK, or other U.S. states with consumer privacy laws), you may have similar rights to access, correct, delete, and port your data. Contact us at privacy@bibscore.com to exercise these rights. We will respond to all data rights requests within 30 days.

10. Community Reports and Moderation

BibScore is powered by community-submitted amenity reports. To maintain data quality and a safe environment:

• We calculate trust scores based on your reporting history to assess data reliability.
• Other users can flag reports they believe are inaccurate.
• We review flagged content and may remove reports that are false, abusive, or violate our guidelines.
• Trusted users (those with a history of accurate reports) may have their edit suggestions applied automatically; other suggestions are queued for review.

If your content is removed, you can contact support@bibscore.com to request a review of the decision.

11. Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. Because there is no industry standard for how to respond to DNT signals, we do not currently respond to them. However, we do not engage in cross-site tracking or behavioral advertising.

12. Third-Party Links

The Service may contain links to third-party websites or services (such as restaurant websites). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Provide notice through the app or via email for significant changes.

Your continued use of the Service after changes are posted constitutes your acceptance of the revised Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Highbound, Inc.
Houston, TX
Email: privacy@bibscore.com
General inquiries: hello@bibscore.com
Security issues: security@bibscore.com